towards a verified cardiac pacemaker
DESCRIPTION
Towards a verified cardiac pacemaker . Asankhaya Sharma Department of Computer Science National University of Singapore. Introduction. Pacemaker Medical device which uses electrical impulses to fix abnormal heart Pacemaker Formal Methods Challenge - PowerPoint PPT PresentationTRANSCRIPT
Towards a verified cardiac pacemaker
Asankhaya SharmaDepartment of Computer Science National University of Singapore
Introduction
• Pacemaker– Medical device which uses electrical impulses to fix
abnormal heart • Pacemaker Formal Methods Challenge– Based on a released informal specification of a previous
generation of pacemaker by Boston Scientific• Related Work
– H Macedo, P Larsen, and J Fitzgerald, Incremental development of a distributed real-time model of a cardiac pacing system using vdm, FM 2008
– A Gomes and M Oliveira, Formal specification of a cardiac pacing system, FM 2009– L. A. Tuan, M. C. Zheng, and Q. T. Tho, Modeling and Verification of Safety Critical Systems: A
Case Study on Pacemaker, SSIRI, 2010
Modeling with SPIN
• Formal Specification in PROMELA• Verification of LTL Properties using SPIN
Sequential Model
UpdateTimers Heart Sensor
Pace Generator
Global Variables
Process - Update Timers
• Clock Updates– Increment Timer– Reset Timer
• Reset other Global variables – AVD– Pulses– Senses
Process - Heart
• Different Behaviors– Normal• Wait NR, Pace A, Wait AVD, Pace V, Repeat
– Miss Ventricle Pace• Wait NR, Pace A, Wait AVD, Skip, Repeat
– Dead• Wait NR, Skip, Wait AVD, Skip, Repeat
– Non Deterministic• Wait NR, May Pace A, Wait AVD, May Pace V, Repeat
Process - Sensor
• Record Paces from Heart and Pace Generator• Update Sense Variables– Pace A -> Sense A – Pace V -> Sense V
• Capture Time of Senses for Refractory Period– ARP– VRP– PVARP
Process - Pace Generator
• Modes Implemented– VOO, AOO, DOO– VVI, AAI, DDI– VVT, AAT– VDD, DDD
VOO Mode
1 2 3Min Time Pace V
Reset Time
VVI Mode
1 2 3Min Time Pace V
Reset Time
Sense V
VVT Mode
1 2 3Min Time Pace V
Reset Time
Sense V 4 Pace V
VDD Mode
1 2 3Min Time Pace V
Reset Time
4Sense AAVD Time
Sense V5
Pace V
LTL Properties
• Deadlock• Pace Limit – LRLURLA and LRLURLV • AV Delay – AVD • Refractory Period – ARP, VRP and PVARP• Inhibiting – AAI and VVI• Triggering – AAT and VVT• Tracking – XDD
Verification Results
LTL Property
VOO
AOO
DOO
VVI
AAI
DDI
VVT
AAT
VDD
DDD
Deadlock X X X X X X X X X X
Pace Limit X X X X X X X X X X
AV Delay X X X X
Refractory Period X X X X X X X X X X
Inhibiting X X X
Triggering X X
Tracking X X
Sequential Model (with Rate Control)
UpdateTimers Heart Sensor
Accelerometer
Global Variables
Pace Generator
Rate Controller
Process - Accelerometer
• Senses motion of Body• Readings correspond to Activity Threshold– Very Low– Low– Mid– High– Very High
Process - Rate Controller
• Uses Activity Threshold to Change Rate of Pacing – Response Factor • Activity Threshold == Low -> RF = 1• Activity Threshold == Med -> RF = 5• Activity Threshold == High -> RF = 9
• Calculate Rate of Pacing– RF and Increment
Hysteresis Mode
• Valid for modes XXIX and XXDX– Inhibiting or Tracking
• Sense -> Wait (Regardless of Rate) -> Pace– Can be simulated using RF
Process - Pace Generator
• Modes Implemented– VOOR, AOOR, DOOR– VVIR, AAIR, DDIR– VDDR, DDDR– VVI_H, AAI_H, DDI_H– VDD_H, DDD_H
VDDR Mode
1 2 3Min Time + RF*Increment
Pace V
Reset Time
4Sense A AVD Time
Sense V5
Pace V
VDDRH Mode
1 2 3Min Time + RF*Increment
Pace V
Reset Time
4Sense A AVD Time + RF*Increment
Sense V 5
Pace V
LTL Properties
• Rate Limit – LRLURLA_R and LRLURLV_R• Rate Control – LRLURLA_RC and LRLURLV_RC• Hysteresis Limit – AAI_H, VVI_H and XDD_H
Verification Results
LTL Property
VOOR
AOOR
DOOR
VVIR
AAI R
DDI R
VDD R
DDD R
VV I H
A A I H
DDIH
VDDH
DDDH
Rate Limit X X X X X X X X
Rate Control X X X X X X X X
Hysteresis Limit X X X X X
Concurrent Model
UpdateTimers Heart Sensor
Pace Generator
TimingVariables
PacingVariables
SensingVariables
Guard Timing
Variables
Guard Sensing
Variables
Verification Results
LTL Property
VOO
AOO
DOO
VVI
AAI
DDI
VVT
AAT
VDD
DDD
Deadlock X X X X X X X X X X
Pace Limit X X X X X X X X X X
AV Delay X X X X
Distributed Model
Heart Sensor Pace Generator
LocalVariables
LocalVariables
LocalVariables
Synchronization
Pu
ls
e
AV
D
sense
Verification Results
LTL Property
VOO
AOO
DOO
VVI
AAI
DDI
VVT
AAT
VDD
DDD
Deadlock X X X X X X X X X X
Pace Limit X X X X X X X X X X
AV Delay X X X X
Distributed AV Delay X X X X
Conclusions and Future Work
• Formal Specification of Cardiac Pace Maker in PROMELA– Sequential– Concurrent– Distributed
• Verification of Desired Properties (LTL)• Extending Distributed Model– Rate Controlled Pacing– Hysteresis Pacing– Model the Noise, Diagnostics and ATR Mode– Add More Parameters like Width and Amplitude
